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Protocol analysis 

The use of local area networking 
is exploding as the many advan- 
tages of networked applications 
are realized. 

With tho large number of 
specialized vendors supplying 
these applications, a gi'eat 
number of protocols, algorithms 
and implementations interact to 
provide networked services. The 
potential for conflicts and 
incompatibilities is unavoidable 
in this compl^^x environment, 
and problem resolution is often 
time-consuming. 

The success of your business 
depends on rehable and efficient 
communication networks. Not 
only is it critical that network 
operability be maintained, but 
users also demand good 
response times from networked 
applications. In cost-sensitive 
organizations, systems must be 
configured for maximum utihza- 
tion and interoperability, and 
routing problems and other 
throughput bottlenecks must be 
avoided. 

A wide variety of tools is avail- 
able to local area network 
managers. Third party netw^ork 
management systems provide 
valuable information on network 
topology and operability. Host- 
resident system diagnostics help 
solve some problems in the 
single-vendor environment. 

Protocol analysis tools are 
needed for troubleshooting prob- 
lems and resolving inefficiencies 
on large, multiple-vendor local 
area networks. 

The HP 4972A resolves prob- 
lems quickly, and provides 
fundamental information to 



optimize networked systems and 
devices. The many powerful 
features of the HP 4972A may 
be used to: 

cjuickly isolate causes of specific 
problems, and verify their 
solutions 

identify addresising problems 
and system incompatabilities 
analyze system behavior and 
performance 

characterize the usage and 
efficiency of network systems 
and devices 

fully test network products prior 
to installation on the network. 



Complex problems, involving 
many different protocols and 
operations, are resolved quickly 
with the broad range of function- 
al ity provided on the HP 4972A. 
Features of the analyzer include: 

comprehensive performance 
analysis (statistical) 
measurements 

protocol interpreters for proto- 
cols most common on Ethernet 
networks 

simultaneous transmit and 
receive capability 
flexibility for programming 
custom tests. 




Graphic representation of network 
behavior helps uncover probLc-ins and 
inefficiencies. This matrix illustrates the 
flow of network traffic. 
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Response time measurements instantly 
yield clues that expedite problem isolation 
and suggest network improvements. 
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Managing TCP/IP and 
DECnet networks 

Network performance analysis 
measurements on the HP 4972A 
for TCP/IP and DECnet make 
the underlying working of your 
network readily apparent. 
Optimizing system configuration 
for maximum efficiency of 
networked applications, 
recognizing marginal operating 
conditions, and evaluating 
network products are all easily 
accomplished when these tools 
are employed. 




Graphic depiction of send window 
values provides an instantaneous view 
of the dynamically variable flow control 
behavior between TCP/IP-based 
systems. 
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True end-to-end throughput measure- 
ments — encompassing all factors, 
including retransmissions and 
delays — are available in both graphic 
and tabular formats. 

Understanding the behavior of 
networked applications is 
facilitated by the HP 4972A's 
performance analysis measure- 
ments. Specific conversations 
are isolated and the frames are 
analyzed for connection statis- 
tics on end-to-end parameters. 
This forms the basis for 
intelligent decisions that will 
maximize network resources, as 
well as the productivity of its 
users. 




Stimulus-response and custom 
tests provide unmatched flexibil- 
ity and powerful capability 
through the softkey-driven 
programming menu on the 
HP4972A. A test library, 
including many programs for 
solving common networking 
problems, is included to get you 
started. 
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This program from the utility disk 
identifies active stations on 
DECnet networks. 
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Balancing resources of devices 
and systems across a network 
minimizes equipment require- 
ments and improves perform- 
ance for all users. Network 
congestion, and resulting poor 
response times, may be allevi- 
ated by modifying network 
topology or configuring local 
servers. 




The busiest systems on the network are 
identified by these statistics on network 
layer addresses. Results may also be 
tabulated only on frames through a 
particular gateway or router. 



Downtime is minimized when 
network inefficiencies are 
discovered promptly. 
The HP 4972A helps make less 
than optimal configurations and 
implementation anomalies 
apparent before the network is 
rendered useless and panic 
sets in. 




This measurement from the DECnet 
network performance analysis applica- 
tion indicates a disproportionate 
number of routing messages, warrant- 
ing further investigation. 




Optimize performance of a TCP/IP or 
DECnet network with powerful 
upper layer statistics. 
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Solving problems and 
avoiding bottlenecks 

Protocol interpreter applications 
for the HP 4972A present 
protocol header information 
(contained in each frame) in an 
easily understood manner. In 
addition, the protocol interpret- 
ers expedite frame-by-frame 
troubleshooting by: 

• highlighting incorrect and 
invalid header field values 

• presenting information in 
common and easily recognized 
formats 

• substituting logical names for 
numeric values of addresses and 
services. 



•e Mir 15 4]4r93:53.ae9» im asn£ t..iMjai....it± 

DB^' : '_\-^UE MUX turn . • . _ 



3 STEHt k.;-T-. J^:- ■ 



System incompatabilities are quickly 
spotted in frames decoded by the 
HP 4972A's protocol interpreters. 




Network connectivity problems, 
that are often intermittent, are 
spotted instantly and effortlessly 
v^hen autosequence tests are run 
on the HP 4972A. Alarms, set 
off when preset thresholds on 
utilization or errors are ex- 
ceeded, may be used to trigger 
other statistical measurements 
to isolate the source of the 
problem. 




The first measurement in the sequence, 
network summary, provides an overview 
of current network activity. 
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This particular measurement sequence 
locates sources of unusually high error 
rates and identifies systems involved in 
broadcast storms. 




When an alarm is triggered, the node 
list statistics measurement records data 
that implicates the ofTending station. 
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Addressing problems are easily 
uprooted with the help of the 
name hsts built into the 
HP 4972A and its apphcations. 
When logical names are 
assigned to numeric address 
values and then substituted into 
decoded frames, these problems 
surface quickly. 
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Physical and network layer address lists 
provide a means for replacement of 
numeric values with logical names. 

Network performance degrada- 
tions are made visible with the 
HP 4972A's analysis software, 
when network characteristics 
are profded and then 
periodically monitored. 




A large number of routing or error 
messages can be a warning sign for 
imminent problems. 



Comparing current network conditions 
to archived results helps spot problems 
and inefficiencies. 



Poor response times and commu- 
nication failures resulting from 
the improper configuration of 
networked systems are resolvtjd 
faster with the HP 4972A and 
its applications. 
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File attributes transferred by Sun 
Microsystem's NFS protocol may 
indicate a mismatch in the amount of 
data transferred and the block size of 
the stored file. 
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Network planning and 
installation 

Trend analysis for a variety of 
network parameters is easily 
accomplished with the 
HP 4972A. Its fully configurable 
statistical measurements enable 
observation of network behavior 
over long periods of time- 
emulating a virtually 
unlimited capture buffer. 




A twelve hour measurement of network 
bandwidth utilization suggests optimum 
times for system backups. 

Interoperability problems are 
easily tackled with the protocol 
interpreters on the HP 4972A. 
Errors are highlighted, length 
fields from all layers are 
correlated and validated, 
commands are matched with 
responses, and data flow 
directions are indicated. 



Rigorous testing of bridges and 
routers prior to installation can 
reduce network downtime and 
user frustration. Performance 
measurements on the 
HP 4972A allow you to monitor 
the performance of a device 
under simulated network 
conditions, quantifying its 
capabilities and limitations. 
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The background traffic generator may 
be used to stress test network devices 
while monitoring their performance. 
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The ISO protocol interpreter also 
reassembles and resequences frames, 
and may be used to verify compliance 
with GOSIP or TOP profiles. 



Results you can count on distin- 
guish productivity-enhancing 
tools from all others. From the 
HP 4972A's custom-designed 
data acquisition hardware, to 
the extensive quality assurance 
testing applied to all Hewlett- 
Packard test equipment, the 
HP 4972A is a LAN protocol 
analyzer like no other. 
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Specifications 

HP 4972A LAN protocol analyzer 

Operating characteristics 

physical interfaces 
—Ethernet/IEEE 802.3, 10 Mbps 
— StarLAN (optional), 1 Mbps 
capture buffer 

— 1 Mbyte memory can store over 2000 frames 
receiver performance 
— data captured at more than 14,000 frames/second 

with full filtering capability 
— 32 microsecond timestamp resolution 
transmitter capabilities 
— ^up to 16 user-definable messages 
— variable preamble lengths and frame check 

sequences 
— data received simultaneously 
information storage 

— pre- or post-filtered capture buffer contents, 
performance analysis (statistical) measurements, 
and test setups may be stored in electronic or hard 
copy form 

— ^frame data may be logged directly to disk 
at 400 kbps, nominally 
post processing 

— stored frame data may be further tested and 
analyzed 
filters and triggers 

— capture conversations and/or protocol types 

— up to 16 user- definable filters or triggers 

— address, protocol field, data pattern, and error 
matching 
timers and counters 

— program controlled 

— 16 event or loop counters 

— 16 transaction or expiration timers 
password restricted access 

— independent passwords for viewing and 
transmitting data 
automatic testing 

— executes programs or measurements on power-up 
LAN test library 

— programs for active station testing 

— filters for capturing specific message types 

— ^various filters, programs and messages 
coaxial cable test 

— open or short conditions reported 
tutorial 

— self-paced training on analyzer capabilities 
remote operation 

—optional RS-232A^.24 interface 

— HP 4972A or personal computer as the master 
unit 
mass storage 

— 20 Mbyte internal Winchester disk 

—600 Kbyte 3.5 in. floppy drive 

— ^two additional drives supported via HP-IB 
external displays 

— ^high-resolution composite video output for 



monochrome monitor 
— optional high-resolution RGB video output for 

color monitor 
compatible printers 
—HP PaintJet, HP ThinkJet 
—high-speed HP RuggedWriter, HP 293X series 
— most ASCII printers 

Physical specifications 

weight (including cables) 

—net 20.86 kg (46 lb) 

—shipping 27.22 kg (60 lb) 
dimensions (height x width x depth) 

—19.58* X 42,55 x 56.52 cm 
(7.71* x 16.75x22.25 in) 
* add 7.62 cm (3 in) to height for pouch 
operating temperature 

—10 to 45 degrees C (50 to 113 degrees F) 
storage temperature (without floppy disk) 

— -20 to 60 degrees C (-4 to 140 degrees F) 
power requirements 

—90 to 132 VAC, 180 to 264 VAC 

— 47 to 63 Hz single phase 
power consumption 

— 200 watts typical 
electromagnetic compatability 

—complies with VDE 0871/6.78 limit B 

—licensed per FTZ 1046/84 

Software applications 

Network performance analysis applications 

present condensed (statistical) information in both 
graphical and tabular formats. Measurement times are 
variable from 60 seconds to 999 days. Results may be 
saved electronically or in hard-copy form. The basic 
measurements available on these analysis packages 
follow. 

Ethernet network performance analysis (included 
with HP 4972A) 

network analysis 

— utilization percentage, frames/second, or Kbytes/ 
second 

— errors and collisions 

— ^interframe timing and frame length 

— ^frame analysis by filters matched 
node analysis 

— ^transmit and receive stats for active stations 

— transmit and receive stats for logical connections 

— matrix of activity between stations 
transmit statistics 

— ^background traffic generator will transmit random 
or user-defined frames at specified utilization rate 

— channel acquisition time 

— station response time 
automatic sequence 

— programs statistical measurements 

— ^trigger on thresholds exceeded (alarms) 

— data logging to paper or disk 
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TCP/IP network performance analysis 
(HP 18222A) 

connection analysis 

— ^throughput rate and retransmissions 

— ^response time 

— ^packet and send window size 
system activity 

— frames and bytes to/from IP addresses 
network usage 

— IP frames and Kbytes 

— ^TCP port distribution 

DECnet network performance analysis 
(HP 18225A) 

connection analysis 

— ^throughput rate and retransmissions 

— response time 

— frame size 
system activity 

— frames and bytes to/from DECnet addresses 
network usage 

— DECnet frames and Kbytes 

— distribution of message types 

Protocol interpreters decode header information for 
the protocols listed. Name lists provide substitution of 
logical names in the display of decoded frames. Many 
interpreters may reside in system memory, allowing 
frames from multiple protocol suites to be examined 
simultaneously. 

TCP/IP protocol interpreter (HP 18221A) 

protocol headers decoded 

—IP, ICMP, ARP, RARP 

—TCP, UDP 

—FTP, TELNET, SMTP 
errors highlighted 

— header checksums and invalid lengths 
logical name lists 

— IP addresses 

—TCP ports 
direction of data flow indicated 
commands matched with responses 
detailed, summary or hexadecimal displays 
test library 

— ^ARP stimulus/response test 

— ICMP Echo stimulus/response test 

— ^various filters, programs and messages 

DECnet protocol interpreter (HP 18224A) 

protocol headers decoded 

— DRP, NSP, MOP 

— SCP, FOUND 

—DAP, CTERM, LAT 
errors highlighted 

— ^header checksums and invalid lengths 

— protocol violations 
logical name lists 

— DECnet addresses 
detailed, summary or hexadecimal displays 
test library 



— DECnet System ID stimulus/response test 
— ^various filters, programs and messages 

Sun-NFS protocol interpreter (HP 18228A) 

protocol headers decoded 

— RPC, PMAP 

— YP, NFS 
errors highlighted 

— header checksums and invalid lengths 

— rejected frames 
procedure calls matched with replies 
detailed, summary or hexadecimal displays 

XNS protocol interpreter (HP 18223A) 

protocol headers decoded 

— IDP, RIP, ERR, ECHO 

— SPP, PEP 
errors highlighted 

— header checksums and invalid lengths 
logical name lists 

— ^network, host and sockets 
detailed, simimary or hexadecimal displays 

ISO protocol interpreter (HP 18226A) 

protocol headers decoded 

— ESJS, CLNP 

— TPO, TPl, TP2, TP3, TP4 

— Session 
errors highlighted 

— header checksums and invalid lengths 

— ^negotiated option violations 

—profile compliance (GOSIP, TOP) 
frames reassembled and resequenced 
detailed, summary or hexadecimal displays 

Ordering information 

HP 4972A LAN protocol analyzer 

includes Ethernet performance analysis and LAN 
test library 

Option 001 — high resolution RGB color video 

outputs for 25 kHz external color monitor 
Option 002— remote RS-232 interface 
Option 003— Katakana (JIS-8, EBCDIK) 
Option 005 — Star LAN (1 Mbps) network interface 
Option 908 — rack mount 

HP 18221A TCP/IP protocol interpreter 

HP 18222A TCP/IP network performance analysis 

HP 18223A XNS protocol interpreter 

HP 18224A DECnet protocol interpreter 

HP 18225A DECnet network performance analysis 

HP 18226A ISO protocol interpretef 

HP 18228A NFS protocol interpreter 
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HP Sales and Support Offices 



For more information, call your local HP 
sales office listed in your telephone 
directory or an HP regional office listed 
below for the location of your nearest 
sales office. 

United States: 

Hewlett-Packard Company 
4 Choke Cherry Road 
Rockville, MD 20850 
(303) 670-4300 

Hewlett-Packard Company 
5201 ToUview Drive 
Rolling Meadows, IL 60008 
(708) 255-9800 

Hewlett-Packard Company 
5161 Lankershim Blvd. 
No. Hollywood, CA 91601 
(818) 505-5600 



In Europe, please call your local HP 
sales office or representative: 

Austria, COMECON-countries and 
Yugoslavia: 

(0222) 2500-0 

Belgium and Luxembourg: 

(02) 761-34-00 

Denmark: 

(042) 81-66-40 

Finland: 

(0) 88-721 

France: 

(1) 60-77-42-52 

Germany: 

(06172) 16-0 



Hewlett-Packard Company 
2015 South Park Place 
Atlanta, GA 30339 
(404) 955-1500 

Canada: 

Hewlett-Packard Ltd. 
6877 Goreway Drive 
Mississauga, Ontario L4V 1M8 
(416) 678-9430 

Japan: 

Yokogawa-Hewlett-Packard Ltd. 
15-7, Nishi Shinjuku 4 Chome 
Shinjuki-ku 
Tokyo 160, Japan 
(03) 5371-1351 



Greece: 
(01) 68-28-11 

Iceland: 

(01) 671-000 

Ireland: 

(01) 88-33-99 

Italy: 

(02) 92-19-91 

Netherlands: 

(020) 547-6669 

Norway: 

(02)-24-60-90 



Latin America: 

Hewlett-Packard 

Latin American Region Headquarters 
Monte Pelvoux No. Ill 
Lomas de Chapultepec 
11000 Mexico, D.F, Mexico 
(525) 202-0155 

Australia/New Zealand: 

Hewlett-Packard Austredia Ltd. 
31-41 Joseph Street 
Blackburn, Victoria 3130 
Melbourne, Australia 
(03) 895-2895 



Spain: 
900-123-123 

Sweden: 
(08) 750-20-00 

Switzerland: 

(057) 31-21-11 (Headoffice) 
(022) 780-41-11 (Suisse Romande) 
(046) 05-15-05 (Customer Information 
Center) 

U.IL: 

(0734) 777-828 



Far East: 

Hewlett-Packard Asia Ltd. 
22/F Bond Centre 
West Tower 
89 Queensway 
Central, Hong Kong 
8487777 



Middle East and Africa: 

Geneva-Switzerland 
41/22-780-7111 

European Headquarters: 

Hewlett-Packard S.A. 
150, Route du Nant d'Avril 
1217 Meyrin 2 
Geneva-Switzerland 
41/22-780-8111 
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